Docker Rootless (Security Enhanced Mode)

Docker-Rootless-Security-Enhanced

Docker Rootless Install (Security Enhanced Mode)

In this installation we have two security enhancements:  
1- create two dedicated partitions for docker data and volume containers 
2- use a indirect user to access docker container managements

[ Read Comments ]

Docker Rootless Install (Security Enhanced Mode)

In this installation we have two security enhancements:

1- create two dedicated partitions for docker data and volume containers
2- use a indirect user to access docker container managements

Partitions

1- Main Partition is /
2- Docker Partition is /data
3- Container Volumes Partition is /datatank

LVM Partitioning

add two disks in esxi to vm
for each disk do thses commands [/date & /datatank]:
X can be b,c,d - Y can be 1,2,3

for /data:

1- sudo fdisk /dev/sdX
  1-1- Type n to create a new partition.
  1-2- Type t to set type: enter 8e for LVM.
  1-3- Type w to write and exit.
2- sudo pvcreate /dev/sdXY
3- sudo vgcreate data-vg /dev/sdXY
4- sudo lvcreate -l 100%FREE -n data-lv data-vg
5- sudo mkfs.ext4 /dev/data-vg/data-lv
6- sudo mkdir /data
7- sudo mount /dev/data-vg/data-lv /data
8- echo "/dev/data-vg/data-lv /data ext4 defaults 0 2" >>  /etc/fstab
9- df -h   # to ensure partition added successfully

for /datatank:

1- sudo fdisk /dev/sdX
  1-1- Type n to create a new partition.
  1-2- Type t to set type: enter 8e for LVM.
  1-3- Type w to write and exit.
2- sudo pvcreate /dev/sdXY
3- sudo vgcreate datatank-vg /dev/sdXY
4- sudo lvcreate -l 100%FREE -n datatank-lv datatank-vg
5- sudo mkfs.ext4 /dev/datatank-vg/datatank-lv
6- sudo mkdir /datatank
7- sudo mount /dev/datatank-vg/datatank-lv /datatank
8- echo "/dev/datatank-vg/datatank-lv /datatank ext4 defaults 0 2" >>  /etc/fstab
9- df -h   # to ensure partition added successfully

Install Docker Rootless

create appuser:

This appuser would be used fot managing docker through

adduser appuser
usermod -aG sudo appuser
su appuser
mkdir /home/appuser/bin
mkdir -p /home/appuser/.config/docker

Install needed packages

sudo apt-get install -y curl net-tools iptables uidmap dbus-user-session fuse-overlayfs slirp4netns
slirp4netns --version # should be over 0.4.0
sudo apt install --reinstall libpam-systemd

Add needed permissions to created folders

sudo chown -R appuser:appuser /data
sudo chown -R appuser:appuser /datatank

Main Installtion ( Execute line by line - don't copy-paste )

sudo modprobe overlay permit_mounts_in_userns=1
su appuser 
echo '{"storage-driver": "fuse-overlayfs", "data-root": "/data"}' >> ~/.config/docker/daemon.json
sudo systemctl disable --now docker.service docker.socket

echo 'export PATH=/usr/bin:$PATH' >> ~/.bashrc
echo 'export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock' >> ~/.bashrc
echo 'export XDG_RUNTIME_DIR=/run/user/$(id -u)' >> ~/.bashrc
echo 'export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"' >> ~/.bashrc

echo 'Cmnd_Alias DOCKER = /bin/docker' | sudo tee -a /etc/sudoers
echo '%service ALL=(appuser) DOCKER' | sudo tee -a /etc/sudoers
echo 'Defaults env_keep += "DOCKER_HOST"' | sudo tee -a /etc/sudoers


loginctl enable-linger appuser

mkdir -p ~/.config/systemd/user/docker.service.d 
echo '[Service]' > ~/.config/systemd/user/docker.service.d/override.conf
echo Environment=\"DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns\" >> ~/.config/systemd/user/docker.service.d/override.conf
echo Environment=\"DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=slirp4netns\" >> ~/.config/systemd/user/docker.service.d/override.conf

export XDG_RUNTIME_DIR="/run/user/$(id -u)"

dockerd-rootless-setuptool.sh install

systemctl --user daemon-reload
systemctl --user start docker
systemctl --user enable docker

Add this alias to global bashrc to make all users able to run docker cli commands through appuser user:

USER_ID=$(id -u)
echo "alias docker='sudo -u appuser DOCKER_HOST=unix:///run/user/$USER_ID/docker.sock docker'" | sudo tee -a /etc/bash.bashrc > /dev/null

Disable login for appuser and remove sudo permissions (Security Enhancement)

sudo usermod -s /sbin/nologin appuser
sudo deluser appuser sudo

Enable listening on lower ports in slirp4netns (in Docker rootless only ports above 1024 are available to be listened):

echo "net.ipv4.ip _unprivileged_port_start=0" | sudo tee /etc/sysctl.d/50-rootless-docker.conf 
sudo sysctl --system

Now you will be able to run docker ps by other users.

---

Restart the system to apply all changes

add and run hello-world image to test if everything works

sudo systemctl reboot

Extra Content (just for fast install)

After partitioning script:
** Use this script to install docker rootless only after finished partitions creating and formating **

#bin/bash



adduser appuser
usermod -aG sudo appuser
su appuser
mkdir /home/appuser/bin
mkdir -p /home/appuser/.config/docker




sudo modprobe overlay permit_mounts_in_userns=1
su appuser 
echo '{"storage-driver": "fuse-overlayfs", "data-root": "/data"}' >> ~/.config/docker/daemon.json
sudo systemctl disable --now docker.service docker.socket

echo 'export PATH=/usr/bin:$PATH' >> ~/.bashrc
echo 'export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock' >> ~/.bashrc
echo 'export XDG_RUNTIME_DIR=/run/user/$(id -u)' >> ~/.bashrc
echo 'export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"' >> ~/.bashrc

echo 'Cmnd_Alias DOCKER = /bin/docker' | sudo tee -a /etc/sudoers
echo '%service ALL=(appuser) DOCKER' | sudo tee -a /etc/sudoers
echo 'Defaults env_keep += "DOCKER_HOST"' | sudo tee -a /etc/sudoers


loginctl enable-linger appuser

mkdir -p ~/.config/systemd/user/docker.service.d 
echo '[Service]' > ~/.config/systemd/user/docker.service.d/override.conf
echo Environment=\"DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns\" >> ~/.config/systemd/user/docker.service.d/override.conf
echo Environment=\"DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=slirp4netns\" >> ~/.config/systemd/user/docker.service.d/override.conf

export XDG_RUNTIME_DIR="/run/user/$(id -u)"

dockerd-rootless-setuptool.sh install

systemctl --user daemon-reload
systemctl --user start docker
systemctl --user enable docker

echo "net.ipv4.ip _unprivileged_port_start=0" | sudo tee /etc/sysctl.d/50-rootless-docker.conf 
sudo sysctl --system

USER_ID=$(id -u)
sudo echo "alias docker='sudo -u appuser DOCKER_HOST=unix:///run/user/$USER_ID/docker.sock docker'" > /etc/bash.bashrc